feat(config-preview): chrony + wireguard in Config-Preview verfügbar

- chrony.RenderToString(): rendert /etc/chrony/conf.d/edgeguard.conf
  ohne Datei-Write oder Service-Reload
- wireguard.RenderToString(): kombiniert alle aktiven Interface-Configs;
  PrivateKey + PresharedKey werden als <redacted> ausgegeben (sicher für
  UI-Anzeige)
- main.go: beide in WithConfigPreviewers eingetragen
- Settings UI: chrony + wireguard im Generator-Dropdown

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/chrony/chrony.go

@@ -49,6 +49,30 @@ func New(pool *pgxpool.Pool) *Generator {
 
 func (g *Generator) Name() string { return "chrony" }
 
+// RenderToString renders the chrony config to a string without writing
+// to disk or reloading the service. Used by the config-preview endpoint.
+func (g *Generator) RenderToString(ctx context.Context) (string, error) {
+	settings, err := g.Repo.GetSettings(ctx)
+	if err != nil {
+		return "", fmt.Errorf("settings: %w", err)
+	}
+	pools, err := g.Repo.ListPools(ctx)
+	if err != nil {
+		return "", fmt.Errorf("pools: %w", err)
+	}
+	view := View{
+		Settings:        settings,
+		Pools:           pools,
+		ListenAddresses: filterNonLoopback(splitCSV(settings.ListenAddresses)),
+		AllowACLs:       splitCSV(settings.AllowACL),
+	}
+	var body bytes.Buffer
+	if err := tpl.Execute(&body, view); err != nil {
+		return "", fmt.Errorf("template: %w", err)
+	}
+	return body.String(), nil
+}
+
 func (g *Generator) Render(ctx context.Context) error {
 	settings, err := g.Repo.GetSettings(ctx)
 	if err != nil {